Question 1

What is APR1?

Accepted Answer

APR1 is Apache's modified MD5 password hashing algorithm, designed by Poul-Henning Kamp for FreeBSD in 1994 and adopted by Apache for .htpasswd files. The format is $apr1$$ where salt is up to 8 characters and hash is 22 characters of custom base64. The algorithm runs 1000 rounds of MD5 with a specific compositing scheme that mixes the password, salt, and intermediate hashes. APR1 is what `htpasswd -m` (or just `htpasswd` with no flag) generates by default.

Question 2

Is APR1 still secure in 2026?

Accepted Answer

Marginally. A modern GPU can run ~50 million APR1 attempts per second. That means an 8-character password takes only days to brute-force from a captured .htpasswd file. Apache's documentation now recommends bcrypt (htpasswd -B) over APR1 for new deployments. APR1 remains supported for legacy compatibility but should not be used for new files.

Question 3

Can I use this with Apache and Nginx?

Accepted Answer

Yes — both Apache (mod_auth_basic) and Nginx (auth_basic_user_file) accept $apr1$ hashes in their .htpasswd format. Just append the generated line (`username:$apr1$...`) to your password file.

APR1 Generator

Frequently Asked Questions